The Green Sheet Online Edition

January 23, 2017 • Issue 17:01:02

Frost & Sullivan probes cybercrime in APAC region

In a study on cybercrime in the Asia Pacific region, published Dec. 29, 2016, Frost & Sullivan identified eight predominant schemes criminals used to gain unauthorized access into business networks. Citing major attacks against the National Payment Corp. of India and Bangladesh Central Bank, the research firm warned organizations and IT professionals to be vigilant and "cyber-ready" to protect their intellectual property and data in 2017.

Researchers found a direct link between cyberattacks and the increasingly hyper-connected environment of the Internet of Things (IoT). Following are what Asia Pacific Cyber Security practice analysts consider the leading methods of cybercrime and their potential impact on business owners and consumers:

• Business email compromise (BEC) attacks: Email continues to be the leading conduit of fraud and malware, accounting for $19 million in losses in Singapore between January and September 2016. Global BEC attacks increased 20 percent worldwide in 2016, compared with the previous year. Businesses that transact internationally are most vulnerable to these attacks, researchers stated.

  Charles Lim, Industry Principal, Cyber Security practice, Frost & Sullivan, Asia Pacific, predicted that BEC will be more prevalent than both ransomware and advanced persistent threat attacks throughout Asia-Pacific in 2017. "As BECs are relatively easier to execute and evades cyber defense tools better than other popular attack vectors such as ransomware and APTs, it can potentially be the main cyber threat in Asia," he stated.

• Distributed denial of service (DDoS) volumetric attacks: DDoS attacks caused nationwide Internet outages in 2016. Cyber attackers exploited device and network vulnerabilities caused by insecure networks with insufficient defenses against volumetric attacks and default passwords on newly-deployed IoT devices, triggering day-long Internet outages in some areas.
• IoT entry point attacks: Criminals used insecure IoT devices to gain access into numerous business networks in 2016, report authors noted. The prevalence of insecure devices and default passwords has prompted some governments to expand regulatory guidance and security standards for IoT devices, analysts noted. The authors cited a recent botnet attack on IP cameras as an example of "how manufacturers did not include a security process of changing default passwords when connecting the devices to the Internet."
• Ransomware attacks targeting healthcare: Healthcare providers were significantly disrupted by ransomware attacks in 2016. Facilities compromised by infected computer systems had to reroute patients to other hospitals. Major healthcare providers in Asia are HIPAA compliant but are vulnerable to attacks due to their legacy infrastructures and weak security tools, researchers noted.

  Report authors noted the importance of protecting personal healthcare data, which many criminals value more than credit card information, adding, "The healthcare industry needs a good 'cyber health check' before it is too late."

• Drone attacks: Mainstream consumer adoption of drone technology has made drones affordable and easy to use. Researchers believe insecure wireless networks will provide easily accessible methods of transport for nefarious drone attacks.

  Drone use in the commercial sector is also on the rise, adding to the possibility of enterprise-scale drone attacks. Analysts believe drones will be deployed to jam GPS signals on marine and terrestrial vehicles and to drop contaminated USB drives into critical network environments.

Recommended remedial measures

In addition to their predictions and warnings, Frost & Sullivan analysts provided salient advice and described enhanced security methods for protecting critical infrastructures. Following are some examples of how collaborative efforts and emerging technologies can protect against cybercrime:

• Implement emerging technologies: Distributed ledgers such as blockchain can be used to safely transmit sensitive intelligence between trusted parties. "Blockchain may emerge as the technology to facilitate the exchange as it authenticates the trusted party to contribute, obfuscates the contributor's detail with anonymity, and offers a tamper proof system that prevents unauthorized alteration of any data shared," researchers noted.
• Share and distribute threat intelligence: The Information Sharing and Analysis Centers (ISAC), a collaborative effort of government and private sector participants, is focused on creating a public forum where individuals and organizations can share information about the evolving threat landscape. Critics have questioned some participants' authority, warning that untrusted sources may deliberately or unwittingly propagate inaccurate intelligence.
• Employ enterprise-level, proactive security teams: Researchers found an increased number of enterprises committed to staying ahead of attackers by understanding new and evolving cyberattack techniques. This improved understanding will help the teams anticipate criminals' next moves and defend against new attack vectors.
• Initiate bug bounty programs: This relatively new approach uses crowdsourcing to reward potential hackers who identify a network vulnerability or "bug." By paying the hackers to find and report vulnerabilities, organizations hope that hackers will be motivated to use their talents as a force for good.

These recommendations are consistent with Frost & Sullivan's belief in innovation as a core value and the cornerstone of every business. "Identifying, developing and leveraging innovation will give your company a competitive edge and solidifies your company's long term success," the company stated.

The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.